SAP September 2026 Patch Day: CVSS 10.0 'OVERPASS' Kernel Flaw (CVE-2026-44756) and Three Other Criticals Patched; No Exploitation Reported

CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.

Do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems.

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).

Do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today.

SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.

Do: Deploy the SAP GUI for Java patch released with SAP's September 2026 security updates, checking the SAP advisory for the exact affected and fixed versions for your release line. Inventory endpoints running SAP GUI for Java (especially macOS/Linux desktops) and the backends they connect to, prioritizing users who connect to backends accessible to low-privileged or external users. As an interim mitigation, restrict low-privileged accounts' ability to invoke the affected backend functions and treat backend compromise as a path to client workstation takeover when assessing risk.

CVE-2026-76969 is a critical flaw (CVSS 9.4) in SAP's @sap/cds-mtxs npm package, the multitenancy component of the SAP Cloud Application Programming Model (CAP), which performs insufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker who can reach the affected endpoints can send specially crafted requests that cause the service to disclose sensitive credentials. With those credentials, the attacker can replace or delete tenant data, resulting in high impact to integrity and availability and partial impact to the confidentiality of business data. Only deployments running multitenant CAP applications on @sap/cds-mtxs with extensibility enabled are affected. Exploitation has not been observed: there is no known public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

Do: Update the @sap/cds-mtxs dependency in all multitenant CAP applications to the fixed version given in SAP's security advisory for CVE-2026-76969 (part of SAP's September 2026 patch batch) and redeploy the affected applications. Audit whether your CAP applications use multitenancy with extensibility enabled and whether the mtxs endpoints are reachable without authentication, and rotate any tenant-scoped credentials that could have been exposed. As an interim mitigation, restrict network access to the mtxs/sidecar endpoints to trusted callers.